[Mimedefang] validating mail was sent from your domain on bounce back messages

[Werner Günther]

Lucas Albers wrote:
> One of my users is getting mail bounced back, that he did not send.
> I was determing how to prevent this.
> All the mail my users sends is only sent though 1 mail server.
> On all outgoing mail, add an X-Header that indicates it was actually sent
> though your mail server.
> On mail bouncing back, that appears to be sent from one of your users,
> look for the X-Header. If it is not their, then reject the mail.
>
> Has anyone else encountered this particular problem or a solution for this
> sort of problem?

We catch some (most?) of them using the snippet below from filter_begin(). It
looks for "Received" lines in the body of the mail containing ip-adresses of
our mx-hosts. If received lines are present and our host does not appear, we
simply bounce the message. Some mailers do not include the original header in
their bounced messages, though.

if ($Sender =~ /^<>$|^mailer-daemon\@/i) {
    my $found = 0;
    my $receivedline = 0;
# Skip header
    if (open(IN,"./INPUTMSG")) {
        while(<IN>) {
            s/[\r\n]+//g;
            last if /^$/;
        }
# Search body
        while(<IN>) {
            next unless /Received:/i;
            $receivedline++;
# Look for our ip-range. The next line needs to be changed!
            if (/192\.143\.\d+\.\d+/) {
                $found++;
                last;
            }
        }
        close IN;
        if ($receivedline && !$found) {
            return action_bounce("Bounced message did not originate from our
domain");
        }
    }
}


--
-Werner